CVE-2026-54074

Received Received - Intake

Remote Code Execution in TinaCMS CLI

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-01

Generated

2026-07-02

AI Q&A

2026-07-02

EPSS Evaluated

N/A

NVD

CVE-2026-54074

Affected Vendors & Products

Vendor	Product	Version / Range
tinacms	cli	to 2.4.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the @tinacms/cli package versions prior to 2.4.3, specifically in the Forestry-to-Tina migration command. The issue arises because an internal helper function, addVariablesToCode, unquotes any value matching a specific marker inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml files are inserted into this JSON without any sanitisation. As a result, an attacker who controls a Forestry-style project can inject arbitrary JavaScript code into the generated tina/templates.{ts,js} file.

The injected code is placed at the module's top level, meaning it executes immediately when the developer runs tinacms dev or tinacms build, running with the developer's privileges. This is a Remote Code Execution (RCE) vulnerability that allows an attacker to execute arbitrary code on the developer's machine.

This vulnerability has been fixed in version 2.4.3 of @tinacms/cli.

Impact Analysis

This vulnerability can have serious impacts because it allows an attacker to execute arbitrary JavaScript code on the developer's machine with the developer's privileges. This can lead to unauthorized actions such as data theft, modification of files, installation of malware, or further compromise of the development environment.

Since the code executes when running common commands like tinacms dev or tinacms build, an attacker can exploit this vulnerability remotely by controlling a Forestry-style project that the developer uses.

The CVSS score of 7.8 (High) reflects the significant confidentiality, integrity, and availability impacts this vulnerability can cause.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade @tinacms/cli to version 2.4.3 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54074. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70